Is CVE-2018-0798 (Microsoft Office Memory Corruption) being exploited in the wild?

Yes. CISA added CVE-2018-0798 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Any organisation running the affected product should treat remediation as urgent.

What it means when CVE-2018-0798 is being exploited

The practical question is not just whether the flaw exists, but whether attackers are actively using it against real systems. For CVE-2018-0798, the answer is yes: the vulnerability has crossed from theoretical risk into confirmed exploitation, which makes exposure management, patch verification, and compensating controls more urgent than routine backlog handling.

Because the issue is in Microsoft Office memory handling, exploitation often sits close to ordinary document workflows. That matters operationally: users can trigger exposure by opening content that appears routine, so security teams need to treat document delivery channels, macro abuse, and user-facing application hardening as part of the response, not just the patch ticket.

When a vulnerability is in CISA’s KEV catalogue, it is already a prioritisation signal. For readers who need the authoritative exploitation and remediation context, CISA Known Exploited Vulnerabilities Catalog is the clearest public reference point, and the underlying record should be checked alongside vendor guidance.

How to confirm exposure and reduce the attack window

Start by identifying every endpoint, virtual desktop, and user environment that can still run the affected Microsoft Office product. In practice, exposure is often broader than the device inventory suggests because unmanaged laptops, remote desktops, and legacy images can remain connected long after central patching is complete.

Next, confirm that remediation is actually applied, not merely scheduled. For exploited flaws, the useful question is whether the vulnerable Office build is still executable anywhere in the environment, whether security baselines block risky file execution paths, and whether mail and download controls reduce delivery of malicious documents.

The most useful public lookup for product and record context is the NIST National Vulnerability Database, while the CVE Program remains the canonical identifier source for the vulnerability record itself. Together they help teams reconcile what they have deployed with what the advisory actually describes.

What to do if patching has to wait

If you cannot remediate immediately, reduce the conditions that make exploitation easy. That usually means limiting exposure to untrusted documents, tightening attachment handling, isolating high-risk users, and raising inspection on inbound email and web-delivered files. For Office-related memory corruption, simply warning users is not enough because the exploit path can be embedded in normal business traffic.

Compensating controls should be temporary and specific. Use them to narrow who can open external content, where documents can execute, and how quickly suspicious files are detonated or quarantined. If your environment depends on older Office deployments, treat that dependency as a separate exception with an owner, an expiry date, and evidence that the risk is being actively monitored.

For response planning, the best external triage reference is FIRST EPSS, which helps teams understand exploitation likelihood in a broader prioritisation context, even though CISA KEV remains the stronger “act now” signal for a confirmed exploited issue.

Risk and Threat Considerations

Actively exploited Office flaws are dangerous because they sit at the intersection of trusted document handling and user interaction. An attacker does not need a novel delivery mechanism if a malformed file can be delivered through email, chat, shared storage, or a web download and then interpreted by a widely deployed desktop application.

Failure mechanism: Memory corruption in application object handling can let malformed content influence program execution, which turns a normal document-opening action into an exploitation opportunity. That creates a high-probability path from initial delivery to code execution or follow-on compromise when the vulnerable software remains reachable.

Impact: The immediate consequence is that exposed endpoints may be compromised before routine patch cycles catch up, and the secondary consequence is that the same channels used for normal productivity can become reliable intrusion paths. In large environments, that increases the odds of spread, repeat exploitation, and delayed detection.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited CVEs require rapid identification, prioritisation, and remediation.
Recommendation — Prioritise and remediate the exploited Office vulnerability using continuous vulnerability management.
NIST CSF 2.0	ID.RA-01 — Asset vulnerabilities are identified and documented	Confirming exposure depends on knowing where the affected Office product is deployed.
Recommendation — Map where the affected Office software exists before deciding remediation timing.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This is a confirmed exploited flaw that requires disciplined remediation and exception handling.
	SI-3 — Malicious Code Protection	Document-delivered exploitation makes malware and attachment inspection directly relevant.
Recommendation — Remediate the vulnerable Office software and track exceptions until closure. Strengthen content inspection to reduce malicious document delivery and execution.
OWASP ASVS	V16 — Security Logging and Error Handling	Exploitation response depends on detecting suspicious document activity and abnormal execution.
Recommendation — Retain logging that can support investigation of suspicious Office document exploitation.
MITRE ATT&CK	T1203 — Exploitation for Client Execution	The issue is exploited through malicious content opened by a client application.
Recommendation — Detect and block client-side exploitation patterns that begin with user-opened documents.

Practitioner Guidance

What to prioritise: Treat any internet-facing or user-facing system running the vulnerable Office product as urgent, then verify actual remediation status from inventory rather than relying on ticket closure. If the system cannot be patched quickly, place stronger controls around document intake and execution before accepting residual risk.

What to verify: Confirm that vulnerable builds are absent from active use, that exceptions are time-bounded, and that email and download inspection can still catch malicious office documents. For this class of issue, “mitigated” should mean you can show both removal of the vulnerable software and a reduced chance of successful file-based delivery.

Practitioner takeaway: Once a flaw is in KEV, the right question is no longer whether exploitation is possible, but whether any reachable endpoint still gives an attacker a practical path from document delivery to execution.